The app won't work natively due to a lack of attestation, so I have to fire up the browser and user the service.... Exactly how is that more anti-abuse than just using an app without attestation? It's security theater and has no basis in reality.
[1] https://grapheneos.org/articles/attestation-compatibility-gu...
The second reason though I can think a bank would want attestation is as an anti-piracy measure. With a website, you have HTTPS verifying the identity of the domain. With an app, a pirated app or a 3rd party app from any source could hypothetically intercept user's banking information, their scanned checks, or even attempt to cash their scanned checks itself. It's not about making sure the device is secure, as it is killing attempts at 3rd party, modified, or malicious clients. The last thing I want, or the bank wants, is some grandmother downloading the "Wells Fargo Bank Plus with Giant Legible Accessible Text" app she saw in an ad as an APK, installing it, and being a victim of silent fraud for years.
The third reason a bank might want it, is also just simple stupid litigant America. If such a scheme similar to the above were to occur, the bank would likely be sued by victims arguing that the above circumstance was preventable. The victims would also be correct, it was preventable. The bank is then in the unenviable position of telling the jury that supporting the rights of 0.1% of phone modders was more important than victimized grandmothers.
Or, as a bank lawyer would say, just turn on attestation, it costs basically nothing, and then none of the above could happen. Better safe than sorry. After all, is the grandmother not also a customer, and preventing malicious clients in her best interest? Sure, some customers will be inconvenienced, but this is America, where anyone depositing more than $10K is subject to an interrogation.
I don't think this happens nowadays. Android will either block by default or give you a million prompts and warnings before it allows you to install an apk from an unknown source. It's far, far easier to install it from google play. I don't think any grandmother would manage to accidentally ignore the first 3 pages of genuine links on google and then push the right buttons that enable sideloading.
ATMs just scan the checks now too, so why have the middle man? Usually there are limits on customer scanned deposits though, in the range of $5,000-$25,000. I've never heard of a limit on ATM deposits, although I'm sure there is one; I have had atms in WA decline to process warrants from CA state (like a check, but sometimes California has to wait for next fiscal year to clear it).
Yes
https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...